Refactor authentication middleware to support JWT rotation

Refactor the existing auth middleware to support automatic JWT token rotation with configurable expiry windows. Must handle concurrent requests during rotation gracefully. Include refresh token flow and invalidation on logout.

Requirements

Acceptance Criteria

[
  "JWT rotation implemented with configurable expiry window",
  "Concurrent request handling during rotation (no 401 race conditions)",
  "Refresh token endpoint with proper invalidation",
  "Unit tests covering rotation, concurrency, and logout invalidation",
  "No breaking changes to existing auth flow"
]

Claims (1)

{
  "prUrl": "https://github.com/example/auth-middleware/pull/42",
  "description": "Implemented JWT rotation with sliding window expiry. Added refresh token endpoint and logout invalidation. However, the concurrent request handling uses a simple mutex which may not scale under heavy load.",
  "testResults": "18/20 tests passing. 2 concurrency tests are flaky under load."
}

Feedback

No feedback yet.